KERNEL-HARDENING-CHECKER(1)

💖 kernel-hardening-checker(1) 💖

okay bestie, sit down, hydrate, because we're about to talk about locking down your Linux kernel and honestly? it's giving main character energy 🫶

---

✨ NAME ✨

kernel-hardening-checker — the tool that checks the security hardening options of the Linux kernel 🌸

---

🦋 SYNOPSIS 🦋

kernel-hardening-checker [OPTIONS]

that's it. that's the whole vibe. one command, all the options. periodt 💅

---

👑 DESCRIPTION 👑

so kernel-hardening-checker is a tool for checking the security hardening options of the Linux kernel, and it is lowkey iconic. it can analyze Kconfig options (that's compile-time, bestie), kernel command line arguments (boot-time, the moment of truth), and sysctl parameters (runtime, the everyday slay) for these architectures:

• X86_64
• X86_32
• ARM64
• ARM
• RISC-V

🚨 real talk, no cap: changing the Linux kernel security parameters may also affect system performance and functionality of userspace software. like, this is not a "just send it" situation.

so when you're setting these parameters, consider the threat model of your Linux-based information system and thoroughly test its typical workload. i'm serious. test it. all of it. the whole typical workload. 🙈

---

💅 OPTIONS 💅

• -h, --help — show the help message and exit. the classic. the icon. when in doubt, ask for help 💖
• --version — show program's version number and exit. gotta know which queen you're running ✨
• -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail} — select a special output mode instead of the default one. and the modes are:
  • verbose — provide additional information: print the configuration options without a corresponding check and show the internals of complex checks. she's nosy and we love her for it 🔍
  • json — report in JSON format. for when your pipeline needs to eat 🍓
  • show_ok — show only successful checks. hype yourself up bestie 🎀
  • show_fail — show only failed checks. the callout post 😭
• -a, --autodetect — autodetect and check the security hardening options of the running kernel. she does the work so you don't have to 💅
• -c CONFIG, --config CONFIG — check the security hardening options in a Kconfig file (also supports *.gz files). yes gz, we love compression here 🫶
• -v KERNEL_VERSION, --kernel-version KERNEL_VERSION — extract the kernel version from a version file (such as /proc/version) instead of using a Kconfig file. sometimes you just want the number, not the whole story ✨
• -l CMDLINE, --cmdline CMDLINE — check the security hardening options in a kernel command line file (such as /proc/cmdline). boot-time check, we're doing it live 🔥
• -s SYSCTL, --sysctl SYSCTL — check the security hardening options in a sysctl output file (the result of sudo sysctl -a > file). runtime vibes only 🌈
• -p {X86_64,X86_32,ARM64,ARM,RISCV}, --print {X86_64,X86_32,ARM64,ARM,RISCV} — print security hardening recommendations for the selected architecture. it's giving advice column 💜
• -g {X86_64,X86_32,ARM64,ARM,RISCV}, --generate {X86_64,X86_32,ARM64,ARM,RISCV} — generate a Kconfig fragment containing the security hardening options for the selected architecture. she made you a whole fragment. say thank you 🧚

---

🌸 AUTHOR 🌸

Written by Alexander Popov with help from the contributors. the whole squad ate, fr fr 👑

---

🐛 REPORTING BUGS 🐛

found a bug? don't be shy, report bugs at: <https://github.com/a13xp0p0v/kernel-hardening-checker/issues>

(that's the URL as it is, bestie — it just wrapped all pretty in the original page 💖)

---

📜 COPYRIGHT 📜

• Copyright: 2018-2025, Alexander Popov <alex.popov@linux.com>
• License: GPL-3.0

---

and that's the whole page, no notes. this manual is from the kernel-hardening-checker manual, dated July 2025 — and that's your cute lil sign-off, mwah 💋 stay hardened, stay slay, iykyk ⭐